T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:9
- Finding
- Unpinned Third-Party Package Execution Through npx## Vulnerability Details **File Location**: `SKILL.md:9` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Complete Code Snippet**: ```markdown > `npx clawhub@latest install deepseekoracle/lygo-champion-council` ``` ### Technical Analysis The migration instruction invokes the mutable `latest` release of the third-party `clawhub` npm package through `npx`. Unlike a version-pinned and integrity-verified dependency, the effective code executed by this command can change after the Skill has been reviewed. `npx` may download and execute package lifecycle or command-line code with the privileges of the invoking user. The command does not pin an audited package version, provide an npm integrity digest, or independently authenticate the Skill being installed. Consequently, compromise of the npm package, its maintainer account, the package distribution channel, or a future release could turn this documented migration operation into arbitrary code execution. The vulnerable action is not performed automatically by the bundled Python scripts; exploitation requires a user or Agent to follow the documented installation instruction. ### Attack Path 1. An attacker compromises the `clawhub` package, its publisher credentials, or another component of its distribution channel. 2. The attacker publishes a malicious release that becomes the package's `latest` version. 3. A user follows the migration command from `SKILL.md`. 4. `npx` retrieves the mutable malicious release. 5. The package executes with the permissions of the invoking user. 6. The malicious release can access resources available to that user, subject to operating-system and sandbox restrictions. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the invoking user's account. The resulting scope could include reading or modifying user-accessible files, accessing environment variables and locally availabl ...[truncated 255 chars]
- Remediation
- ## Remediation Suggestions - Replace `clawhub@latest` with a specifically audited package version. - Publish and document an expected integrity digest or signed provenance for the package and installed Skill. - Require users to inspect or verify the resolved package before executing it. - Prefer a lockfile-backed installation workflow where feasible. - Avoid implicitly executing newly downloaded code in security-sensitive environments. - Pin the successor Skill to an immutable release or verified content digest rather than relying only on its mutable name. - Run installation with least privilege and in a sandbox that does not expose credentials or sensitive files.